TL;DR: Least privilege grants each user, service or agent only the access its task needs, so a compromise reaches little. Defence in depth layers controls that fail for different reasons, so one failure is not a breach. Example: a SQL injection in a reporting endpoint is the failed layer; a database account that can only read two reporting views, and an egress rule that blocks the database host from the internet, are the layers that hold.
How to approach it
Define both principles in one sentence each, then spend the time on a single concrete incident. Walk it forward: the layer that failed, what the attacker could then reach, and which control stopped them. Close by explaining why the surviving layers did not share the failed layer's weakness.
A strong answer
SQL injection
the failed layer
Read-only DB role
reporting views only
Network policy
no outbound from DB
Detection
unusual query shapes
Least privilege
Each layer grants only what the task needs
Definitions. Least privilege (Saltzer and Schroeder, 1975): every component operates with the least set of privileges needed for the job. Defence in depth: more than one control stands between an attacker and an asset, and the controls fail independently.
Worked example. A reporting service has a search box. A developer builds one query with string concatenation, and an attacker finds the SQL injection.
| Layer | Status | Why it matters |
|---|---|---|
| Parameterised queries | Failed on one endpoint | The bug exists |
| Database account for reporting | Held | It can read two reporting views and nothing else; no access to credentials or payment tables |
| Network egress | Held | The database host cannot open connections to the internet, so out-of-band exfiltration fails |
| Query timeouts and row limits | Held | Bulk extraction through the page is slow and capped |
| Anomaly alerting | Detected | Unusual query shapes from one session page the on-call engineer |
The bug was real and the damage was a handful of reporting rows, because the other layers were built on different mechanisms: database permissions, network rules, resource limits and monitoring. None of them depended on the application code being correct.
The AI version. An email assistant is fooled by an injected instruction in a message. That layer, the model resisting injection, has failed. Least privilege says the assistant's token can read this user's inbox and send only to addresses in the user's organisation. Defence in depth adds an outbound allowlist enforced in the send tool and approval for any external recipient. The injection succeeds and the exfiltration does not.
What makes layers independent. Different mechanisms, different code paths and different owners. Two classifiers from the same vendor are not two layers in any useful sense; a classifier plus an authorization check in code are.
What interviewers probe next
- "Least privilege makes engineers' lives harder. How do you get adoption?" Make the narrow path the easy path: role templates per task, automatic short-lived credentials, and fast approval for exceptions.
- "How do you know your layers are independent?" Ask what single bug, credential or outage would defeat two of them at once; if one exists, they are one layer.
- "Which layer would you build first?" The one closest to the asset that does not depend on the model or the application being correct, usually authorization and scoped credentials.
What if?
What if · interview follow-ups
Hold your answer as the constraints change
A reporting service needs to read sales data and produce monthly PDFs for managers, and currently uses the database owner account.
Start here
What is least privilege?
What does the service actually need?
Granting each user, service or agent only the access its task needs, so a compromise reaches little. The reporting service needs read access to sales views, nothing more.
Carry it forwardGrant only what the task needs.
Weak answerOwner accounts for convenience.
Constraint changes
What is defence in depth?
What if one control fails?
Layering controls that fail for different reasons, so one failure is not a breach. A bug in one layer is caught or limited by another.
Carry it forwardIndependent layers stop single failures becoming breaches.
Weak answerSeveral layers that fail the same way.
Constraint changes
How do they combine for a SQL injection here?
What could injection do with a read-only view account?
Injection in a report filter is the failed layer. A read-only account limited to sales views means the attacker can read sales data but not modify it, read other tables or create users; monitoring catches unusual queries.
Carry it forwardLeast privilege bounds failure impact.
Weak answerRelying only on input validation.
Constraint changes
What other layers would you add?
Which failures are independent?
Parameterised queries, network rules so only the service reaches the database, PDF generation in a sandbox, and managers authorised per report. Each fails for a different reason.
Carry it forwardChoose layers with different failure modes.
Weak answerThree filters on the same input.
Constraint changes
How do you keep privileges minimal over time?
What stops permissions creeping back?
Review grants periodically, alert on privilege changes, and use infrastructure as code so permissions are visible and reviewed.
Carry it forwardReview and codify privileges.
Weak answerOne-time cleanup.
Now defend it
How would you redesign the service?
Give it a read-only account limited to sales views, parameterise queries, restrict network access to the database, generate PDFs in a sandbox, authorise managers per report, monitor unusual queries, and manage permissions as reviewed code.
How it's scored
Weak: Defines both terms and lists controls with no example of one failing.
Hire: Walks one realistic failure and shows which scoped permission or second layer limited it.
Strong Hire: Explains why the layers fail independently, covers detection as well as prevention, and applies the same reasoning to an agent.
Common mistakes
- Calling two filters of the same kind "defence in depth".
- Granting broad roles "temporarily" with no expiry.
- Forgetting detection, so a contained attack goes unnoticed.
- Giving agents every tool in case they need it.